Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a program (motion) that serves a web page showing a live camera feed. I want to make that feed available via internet, but using SSL and a certificate so the feed can only be seen by those that have the appropiate certificate. What I want to know: Is there something like a proxy that reads from the server, and serves an SSL version of it?

share|improve this question
how many viewers do you expect? – gravyface Aug 8 '11 at 3:23
Not more than 5 – Tomas Aug 8 '11 at 3:37
up vote 8 down vote accepted

Install Apache with a relevant vhost, and use ProxyPass (and probably ProxyPassReverse) to do the proxying to your webcam. Client certificate authentication is a touch trickier, but not much; surprisingly enough, Google search results for "apache client certificate authentication" are very useful.

share|improve this answer
Since I already have apache for a web server, this is the most appropiate soltution. Thanks! – Tomas Aug 8 '11 at 16:33
The only problem, how do I create a client certificate having my own CA file? Is there a openssl command? – Tomas Aug 8 '11 at 17:14
Yes, there is. Best to ask that as a separate question, though. – womble Aug 8 '11 at 17:52

Womble's suggestion of an Apache reverse proxy is an excellent suggestion. An alternate solution would be to configure stunnel to wrap it. Stunnel will be more lightweight than Apache if you aren't looking for any of the added benefits of having a full web server in front of your camera.

share|improve this answer
Does stunnel support client certificates? – gravyface Aug 8 '11 at 11:51
stunnel supports a certificate for auth, wouldn't necessarily call it a client cert and you would probably struggle to have more than one so not much use if you are looking to disable just one users access. Apache or other proxy is likely the better option for fine grained control. – Michael Henry Aug 8 '11 at 16:04
@Michael Henry: You're entirely wrong, stunnel will work with a regular CA infrastructure. It perfectly supports client certificates. It's not a struggle, it's in fact quite easy. – bahamat Aug 8 '11 at 17:53

Most all-purpose webservers also have a proxy module, that includes Apache with mod_proxy, as well as Nginx and lighttpd for a more lightweight solution.

If you just want an SSL proxy, meaning a component which only receives SSL traffic, unpacks it, transfers it to a backend service and re-encrypts the answer, you should have a look at either stunnel or stud. As these tools do only that, they are easier to setup and generally faster and less resource-consuming than the alternatives (esp. Apache)

share|improve this answer

Another option that you may already have available to you is VPN. Depending on the firewall you have in front of the Web cam machine/DVR, you could setup mobile IPSec VPN and dial into the firewall first, then access the camera via it's internal IP (assuming again that the camera machine is NAT'ed behind the firewall).

Most "business" firewall/routers offer VPN capabilities now.

With this option, you could completely disable port forwarding so that your camera machine is not listening on the outside anymore and would only be accessible after establishing a VPN connection.

This would provide you with encryption and authentication with potentially less learning curve than setting up Apache as a reverse proxy and no additional cost in hardware (again, this depends on what you have).

Downside is that you'd need to configure a VPN client on each machine where you'd want to view the cameras, but there would be some additional admin overhead with client certificates as well.

It should also be mentioned that, depending on encryption/protocol, VPN does add overhead, which may factor into network throughput, but this shouldn't be an issue with the number of users you're expecting and the likelihood that the camera won't be viewed concurrently very often.

If you only plan on accessing the camera from one remote location*, you could also setup an IPSec tunnel between the remote location's and the camera location's firewalls (called a site-to-site IPSec VPN tunnel). This way, you wouldn't need to configure VPN clients on each machine where you're planning on viewing the cameras: you could just pull up the camera's Web interface in any browser on any machine at that remote location (depending on firewall rules of course).

If you provide us with the firewall make/model, we can suggest a configuration that's best.

*you could most certainly setup additional site-to-site VPN tunnels. But if the 5 users are all at different Internet locations, it's a bit overkill going through the process of setting up IPSec tunnels, so VPN clients would be more practical (or a combination of the two: i.e. if 4 of the 5 users are at one Internet location, setup an IPSec tunnel there; the 5th user could use a VPN client).

share|improve this answer

What you describe is do-able, yes. I imagine there are a number of tools that can do this, but I'm pretty confident that apache can do this. You're describing a 'reverse proxy' (something to google) and certificate based authentication. For the first, you probably want mod_rewrite, but I don't have a great deal of experience with the latter.

I wouldn't be surprised if a few other tools could do this, e.g. squid or an SSL accelerating appliance.

share|improve this answer
Less opinion and more facts please. – Chris S Aug 8 '11 at 12:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.